Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Indirect prompt injection in a PDF makes Claude Computer Use run a filesystem-destroying command

AIR-2024-0044 AIR record · 2024-10-anthropic-claude-computer-use-rm-rf
Open in dashboard About
From the supporting source
we’ll share how an indirect prompt injection can cause Claude Computer Use to perform one of the most destructive commands in the Unix/Linux environment: deleting all the system files via the command “rm -rf /”.hiddenlayer.com
The record
Disclosed
2024-10-24
Vendor
Anthropic
Product
Claude Computer Use (public beta reference implementation)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Claude Computer Use ran the destructive command via its bash tool
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection document
Impact type
Data destruction, Code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Computer Use containers/hosts processing untrusted documents
Capability abused
bash_toolfile_ingestionscreen_control
Defense & remediation
Recorded defense
Claude refusal guardrails
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI05 Unexpected Code Execution (RCE)ATLAS AML.CS0046computer_usedestructive_actionjailbreak_plus_injectionobfuscated_payload
Curator notes
HiddenLayer. Payload was base64/ROT13-obfuscated and framed as a 'safe test environment' to defeat refusal behaviour.
Supporting sources
Cite as
Enkrypt AI. "Indirect prompt injection in a PDF makes Claude Computer Use run a filesystem-destroying command". AIR, AIR-2024-0044. https://agentincident.vercel.app/i/AIR-2024-0044/ (accessed 2026-10-19).